Examples

The following examples demonstrate common tagging configurations across Tenable One Vulnerability Management and Tenable Security Center.

Example 1 — Auto-Tag by Operating System Family

Tag all Linux assets for separate patch tracking and ownership assignment.

Setting Value
Category OS Family
Value Linux
Tag Type Automatic

Rule (Match Any):

Filter Operator Value
Operating System contains Linux

All assets where the detected OS includes the string "Linux" — such as Ubuntu Linux 22.04, Red Hat Enterprise Linux 9, or Debian GNU/Linux — receive the tag automatically. As assets are re-scanned and OS data updates, tag membership updates with them.

Example 2 — Tag AWS Production Assets in a Specific Region

Isolate production assets in the US-East-1 region for compliance reporting and access control.

Setting Value
Category Environment
Value AWS-Prod-US-East
Tag Type Automatic

Rule (Match All):

Filter Operator Value
AWS Region is equal to us-east-1
AWS EC2 Name contains prod
Source is equal to AWS

This rule catches only EC2 instances in us-east-1 whose name contains "prod," ensuring staging or development instances are excluded from the compliance scope.

Example 3 — Manually Tag Critical Exceptions

Mark assets that are business-critical but exempt from the standard 30-day patch SLA. Because this is a judgment call rather than a rule, a manual tag is appropriate.

Setting Value
Category Patch Policy
Value SLA-Exception
Tag Type Manual
Value Description Assets exempt from the standard 30-day patch SLA. Requires CISO approval.

Analysts filter the Assets view by Patch Policy:SLA-Exception to see exactly which assets carry the exception. Report owners can use the same tag to build a dedicated dashboard scoped to only those assets.

Example 4 — Mirror Cloud-Native AWS Tags

Your AWS team already tags EC2 instances with an Owner key. Bring that context into Tenable One Vulnerability Management automatically without any manual effort.

Setting Value
Category Cloud Owner
Value PlatformTeam
Tag Type Automatic

Rule (Match All):

Filter Operator Value
Resource Tags (By Key) is equal to Owner
Resource Tags (By Value) is equal to platform-team

Whenever your AWS team assigns Owner = platform-team to a new EC2 instance, Tenable One Vulnerability Management picks it up on the next data import and tags the asset automatically.

Example 5 — Tag High-Risk Assets Using Risk Scores

Use Tenable One risk scores as tag rule inputs to automatically identify the highest-risk assets in your environment. Requires a Tenable One license.

Setting Value
Category Risk
Value Critical-Tier
Tag Type Automatic

Rule (Match All):

Filter Operator Value
ACR ≥ 8
AES ≥ 650

Any asset with a high Asset Criticality Rating and high Asset Exposure Score receives this tag. Tag membership updates as scores change, making it easy to build dashboards, remediation tickets, or access group restrictions scoped to only the highest-risk assets.

Example 6 — Tenable Security Center Dynamic Asset Tag for PCI Scan Targeting

In Tenable Security Center, create a PCI-Scope Dynamic Asset Tag that automatically tracks the assets in scope for quarterly PCI assessments, so scans and reports can target the current PCI population without manual list maintenance.

Before You Begin

  • Confirm you have an Organizational User role with appropriate permissions.

  • Confirm Tenable Security Center has already run an initial discovery scan against the PCI-scope assets.

To create the PCI-Scope dynamic asset tag:

  1. Navigate to Assets → Asset Tags.

    The Asset Tags page appears.

  2. Click the Add button, then select Dynamic Asset Tags in the Other section.

    The Add Asset Tag page appears.

  3. In the Name field, type PCI-Scope.

  4. Define rule-based condition statements that identify the PCI scan population — for example, an IP range filter matching the PCI network segment.

  5. Click Submit.

    Tenable Security Center saves the PCI-Scope Dynamic Asset Tag and begins evaluating matching assets using results from Tenable Security Center scans.

What To Do Next

Target the PCI-Scope Asset Tag from a scan policy so quarterly PCI assessments automatically pick up newly added assets. If you also want a lightweight free-text descriptor auditors can search on the scan policy itself, set that policy's separate Label field to PCI-Scope as well — see the Tags in Tenable Security Center topic for how Labels and Asset Tags differ.